Contents

Statement of commitment 02 IMA background 03 Glossary 04 Key findings of the assessment 05 Highlights table 12 Recommendations to address risk areas 14

1 The value of information 19 2 Information and supporting technology 30 3 Information risk, governance and oversight 40 4 Records, review and transfer 54

© Crown copyright 2016.

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Statement of commitment

The following statement was provided by the Permanent Secretary of the Department for Education (DfE). It was published on 22 October (prior to the interviews) on the department’s GOV.UK pages – the first time a government department has publicly published a statement of commitment to the IMA process.

‘The Department for Education last undertook an information management assessment (IMA) in 2009. This was part of the regular programme of assessments that The National Archives conducts to review information, records and knowledge management standards within government departments. To demonstrate the strength of the Department for Education’s commitment, I have asked The National Archives to carry out an IMA reassessment in November 2015.

‘The Department for Education recognises the importance of meeting its corporate obligations to manage, protect, work with and exploit effectively the information it holds. The report that The National Archives produces will help me to support all aspects of knowledge and information management across the department. It will help ensure that our information, knowledge and records are captured, managed and preserved appropriately, and information risks and sensitivities are handled appropriately.’

Chris Wormald Permanent Secretary Department for Education

www.gov.uk/government/news/dfe-commitment-to-information-management-assessment IMA background

The Department for Education (DfE) first underwent an Information Management Assessment (IMA) in 2009, when DfE was known as The Department for Children Schools and Families (DCSF). The 2009 IMA report can be found on The National Archives’ website at nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/

DfE subsequently committed to an IMA reassessment, carried out in November 2015. The reassessment entailed a detailed review of supporting documentation and the current information system, followed by interviews with senior staff, specialists and practitioners in DfE’s London and Manchester offices – staff from the Coventry offices were interviewed by telephone. These were carried out between 16 and 20 November 2015. Additional interviews with key staff were conducted by telephone up to 26 November 2015 and the Lead Non-Executive Board member was interviewed on 21 December 2015.

The following report provides a summary of good practice and risks identified. IMA reports and departmental action plans are published on The National Archives’ website at: nationalarchives.gov.uk/information-management/our-services/ima-reports-action-plans.htm Glossary

AC – Advisory Council CTO – Chief Technology Officer DCSF – The Department for Children Schools and Families DfE – The Department for Education DRO – Departmental Records Officer DSU – Departmental Security Unit DSO – Departmental Security Officer ERMS – Electronic Records Management System FOI – Freedom of Information IAO – Information Asset Owner IAR&O – Information Asset Registration and Ownership IAR – Information Asset Register IICSA – Independent Inquiry into Child Sexual Abuse IM – Information Management IMA – Information Management Assessment IMC – Information Management Consultant KIM – Knowledge and Information Management KM – Knowledge Management MC – Management Committee PIRAS – Privacy and Information Rights Advisory Service PST – Personal Storage Table PAC – Public Accounts Committee RM – Records Management SIRO – Senior Information Risk Owner STA – Standards and Testing Agency Key findings of the assessment

1 The value of information

| Performance rating | |--------------------------------------------------------| | Communicating and realising value | Satisfactory | | Managing information as an asset | Satisfactory |

Situation at the time of the last Information Management Assessment (IMA) in 2009:

Overall, information management and records management had a low departmental profile. The priority for the department was information assurance, which was perceived as more important.

The Department for Children, Schools and Families (DCSF) had a core of committed and professional staff with responsibility for Knowledge and Information Management (KIM). This team reported to several boards that had oversight of distinct areas of information management.

Information was not truly valued as an asset, and the department had not clearly defined which of its information assets had business value. Information owners did not always take full responsibility for their information.

- The Department for Education (DfE) has clearly articulated the value of information through key policies and supporting documentation, as well as through clear messages from senior management, including the Permanent Secretary. DfE is proactive in publishing data and information and recognises its obligations in responding to information requests.

- DfE’s approach to identifying and reporting against its information assets is in line with guidance published by The National Archives. Departmental officials have expressed that not all information assets are being recorded. The Senior Information Risk Officer (SIRO) is currently working with other key colleagues to provide greater assurance to the Permanent Secretary that DfE’s information assets are subject to the right level of oversight and control.

- DfE has yet to clearly articulate how it will improve information management. It has also yet to outline how information management will link into future improvements to information technology. Information Services should collaborate with key stakeholders to ensure a more joined-up approach for DfE in managing its data and its records.

2 Digital information and supporting technology

| Performance rating | Development area | |--------------------|------------------| | Supporting information through technology | Development area | | Digital continuity and IT change | Development area |

Situation at the time of the last Information Management Assessment (IMA) in 2009:

Meridio was introduced in 2004 to be the primary system for the capture and management of electronic records. In 2009, the department had recognised that there were a number of issues that inhibited the effective use of the Meridio system. The department did not ensure that the guidelines for use were disseminated or that usage of Meridio was monitored and reported corporately. Aligned to this, there was a need to ensure that all the appropriate support mechanisms were in place – such as training, updated guidance and support for the Information Managers’ networks.

DCSF was looking at alternative ways to manage its electronic records and documents. The result of this review was the introduction of Information Workplace (IWP), a SharePoint system. During IWP’s implementation, DCSF needed to address the legacy issues surrounding the storage of the information already created in Meridio. It was important that these developments were not run solely as ICT projects, but also as KIM projects. A migration policy would allow for records and documents with business value to be reviewed, migrated and stored so that they could be held for future reference. • DfE’s current information systems have the potential to provide accessible and discoverable information. The capture of corporate records meets DfE’s requirements and those of its key stakeholders. However, due to certain cultural and technical issues, the information system (known as Workplace – a SharePoint system) is not being utilised to its full potential. The majority of information (including legacy records) is being maintained and saved to shared drives, personal drives and email inboxes/archives. This represents a key risk to DfE that needs to be addressed.

• The current set-up of Workplace is quite restrictive and does not allow a key potential benefit of the system, which is the controlled sharing of information to improve collaboration and decision-making. Although this has been noted as a concern by staff, it should be re-examined to establish the right balance between securing sensitive information and providing access.

• DfE is currently focusing on maintaining and upgrading current systems and processes to support its main strategic and operational goals. There are indications that the Information Technology area (IT Group) is not considering Information Management (IM) requirements when developing new systems, or including KIM specialists in the planning or development stages. The IT Group needs to collaborate with key KIM staff to ensure that IM requirements are met.

• There has been, as yet, no forward planning of how DfE will manage its legacy data or records. An e-Discovery exercise is currently underway to establish the volume of its digital estate. As part of this, DfE needs to establish the value and context of its data and its records. This will ensure that it can satisfactorily respond to information requests and meet its statutory requirements under the Freedom of Information Act (FOI) Act and the Public Records Act, and rationalise how it manages its digital estate. 3 Information risk, governance and oversight

| Performance rating | | |------------------------------------|----------| | Recognising information risk | Satisfactory | | Establishing control | Development area | | Providing guidance | Satisfactory | | Measuring Impact | Development area |

Situation at the time of the last Information Management Assessment (IMA) in 2009:

Although information assurance was defined as one of the top three risks to the department, there were gaps in the department’s assessment and management of wider information risk.

The Information and Records Management Team was responsible for producing information and records management guidance. Although the guidance was comprehensive, it appeared not to have been recently updated. The size and the resource levels of investment in the team had affected the team’s ability to be proactive. Staff indicated that they were not always confident that they had sight of relevant policy changes or new ways of working. Understanding of what constituted a record was inconsistent.

Published metrics could have served as an effective management tool to ensure that the department could meet its objective to raise organisational competence and awareness of what constitutes good knowledge and information management. Without a commitment to developing some regular monitoring metrics for reporting at senior management level, there was a risk that poor information management practices would continue. • DfE has clear policies and documentation that outline how it should manage information risk. These polices have been noted and approved by DfE’s Management Committee. However, this senior-level awareness of information risk – and of its importance – is not matched at the operational level. The SIRO, along with other key stakeholders, plans to improve awareness of the importance of ensuring that information risks are monitored and escalated when required.

• Overall control of Knowledge and Information Management is currently devolved to a number of senior staff, such as the Deputy Director for Change Programme and the Chief Executive Officer for the Standards and Testing Agency. There is informal collaboration between these staff but no formal governance structure other than the reporting of current IM issues to the Management Committee. A more formalised governance board would ensure a more collaborative approach in the way that DfE manages its data and records, and the technology that supports it.

• The investment in the development of Workplace (and supporting guidance and training) by the Information Services team should be commended. The managers within the Information Services team aim to develop a more joined-up approach to IM, including encouraging greater networking between KIM staff and Information Asset Owners and reviewing current guidance to ensure that it meets business requirements. This should include mandatory training for new staff and a coordinated training and communication programme.

• There is no current oversight of how staff members manage their information or comply with record-keeping requirements. Workplace can provide the means to measure how information is being captured. The current governance of Workplace does not allow for oversight by a central area. DfE should re-examine how the current Workplace system can provide statistical data and reports on key record-keeping tasks. 4 Records, review and transfer

| Performance rating | |---------------------| | Oversight of records and selection | Development area | | Implementing disposal decisions | Development area |

Situation at the time of the last Information Management Assessment (IMA) in 2009:

There was an established Records Management Policy that covered the retention, review and disposal of registered paper files, but no similar policy for electronic records. This would have had an impact on the efficiency of the organisation, how it managed its electronic records and exposed the department to risk.

There were robust processes in place to ensure that items sent off-site could be tracked and retrieved when required. There was evidence that some teams sent all closed files and documents for off-site storage without consideration of their business value.

The lack of definition of what should be kept had led many staff to adopt the default position of keeping everything. Although retention schedules existed, there was little evidence that these were reviewed or enforced.

According to internal DCSF analysis there were approximately 1,500 shared areas containing numerous documents and records. These contained the majority of the documents created by the department. There was a real risk that, if this situation had continued, the department would have been unable to keep track of the information that it produced. • DfE, through the Departmental Records Officer (DRO), has a good understanding and oversight of its inactive paper records. Recent organisational changes and rationalisations have highlighted legacy holdings, as well as areas that are still utilising paper files to capture knowledge and information. The majority of the DfE’s digital records are not under the control of the DRO or any other official other than the actual creator. As part of the e-Discovery exercise to determine the volume of DfE’s digital holdings, the DRO should look to establish greater control and oversight of DfE’s information. The DRO should look to provide regular and direct reports to DfE senior management to ensure that they are aware of any emerging issues as well as of good practice and improvements made.

• DfE is currently meeting its statutory requirements for the Public Records Act and the 20-year rule Implementation Plan. It is acknowledged that DfE faces key challenges in identifying records for the Independent Inquiry into Child Sexual Abuse, and in managing inherited records and recently identified legacy holdings. The DRO is currently working with The National Archives and should be supported in developing a plan for dealing with the appraisal of DfE’s paper and digital records, including assessing the sensitivity of the information.

## Highlights table

The following are among the areas of good practice identified at the time of the assessment. They include systems and approaches that other government organisations may find helpful in mitigating information and records management related risks:

| Highlights of the 2015 IMA | |---------------------------| | The Department for Education (DfE) has outlined why information and its proper management is important in its draft Records Management Policy and Information Management Strategy. The Records Management Policy notes that proper records management ensures a good basis for accountability, ensures compliance with relevant legislation, and assists in defining how long records should be retained before they are either destroyed or transferred to The National Archives. | | DfE’s Information Asset Registration and Ownership Policy defines what an information asset is and the key requirement of having and maintaining Information Asset Registers. The policy also outlines clear governance and the reporting structure for information assets from Information Asset Owners (IAOs) to the Senior Information Risk Owner (SIRO), and upwards to the Permanent Secretary. | | DfE’s Information Asset Register (IAR) clearly notes key fields as recommended in guidance published by The National Archives (owner, team, description, source, business purpose, retention). Each Information Asset has defined owners who are aware of the importance and rationale behind maintaining an up-to-date register, to ensure that information (whose loss, theft or corruption would damage the business) is effectively tracked, monitored and reported against. | | DfE’s Information Risk Policy provides a clear yet open interpretation of information risk that is not restricted to information security but also encompasses risks to the effective management, sharing, use and benefit realisation of information. The policy has been developed in line with HMG Security Policy Framework and the DfE policy meets key requirements such as ownership and defining a risk management structure. | DfE’s IT Group has recently adapted its processes for capturing school census information, which is based on the technological capability of each school, to assist clients in providing data. This shows that DfE is responsive to user needs.

DfE has published guidance, advice and templates for researchers and third parties to obtain special permission to use data from key datasets (such as the National Pupil Database), subject to conditions (including data protection, information security, and business need). Requests for access to data had doubled and DfE was one of the first in HM Government to use an open source model when publishing data.

DfE conducts regular ‘Learning Months’ that provide a platform for sharing experience and learning, and which also improve awareness of priorities and future planning. The December 2015 Knowledge Management month was scheduled to cover all DfE sites and include presentations that would showcase current and new guidance, and highlight best practices within and outside DfE.

## Recommendations to address risk areas

### Recommendation 1

The Department for Education (DfE) should continue to develop and improve its approach to the management of its current and legacy digital information.

This would be supported by:

- IT Group and Information Services reviewing the IM and IT strategies to ensure a joined-up approach to the management of data and records.
- Developing a plan for the ongoing continuity of digital information (both current and legacy). This would build on the work to identify critical systems, data and their value.
- Ensuring that IM requirements are considered when systems and platforms are implemented and upgraded.
- Making it mandatory to save official records in Workplace.
- Placing greater restrictions on the use of email inboxes and PST (Personal Storage Table) files (including size limits) to encourage staff to save information into Workplace (linking to awareness and training for Workplace and Colligo – see Recommendation 4).
- The Information Services team, collaborating with the Senior Information Risk Officer (SIRO), the Departmental Security Unit (DSU), and Policy leads, developing clear policy and guidance on what information can be published and made accessible through Workplace, and which areas need secure collaborative sites to enhance secure information-sharing and decision-making processes.
- Content Managers and Policy leads identifying other work areas with which they need to collaborate and share sensitive information (as part of decision-making or policy development); and liaising with the Information Services team on requirements for establishing shared/controlled Workplace sites.
- Information Services developing a customised template (based on the intranet classification scheme) to assist Workplace users and Content Managers in establishing a controlled file structure.

### Recommendation 2

**The Information Services team and Information Assurance staff should work together to improve oversight and control of DfE’s information assets.**

This would be supported by:

- Continuing the current review of the governance and reporting models, planning to ensure that the reporting of information assets by the Information Asset Owners (IAOs) is monitored on a monthly basis.
- Reviewing the current definition of information assets, and identifying what key fields need to be mandatory in the Information Asset Register, to ensure that DfE is satisfactorily meeting its statutory and reporting requirements.
- Examining the option of adopting a proportionate approach to ownership of information assets, particularly for those that have been identified as having critical or high-level importance to DfE.

### Recommendation 3

**DfE should ensure that the new information management strategy sets goals for the whole department and is linked to improvements in technology, governance and culture.**

This would be supported by:

- Establishing a Knowledge and Information Management Governance Board to formalise current relationships and ensure clearly documented reporting mechanisms.
- Ensuring that IM requirements are considered when implementing or upgrading new systems and procedures, and when migrating data and records to new platforms.
- Ensuring that accreditation and assurance of systems is at an appropriate reporting level, as agreed by the Management Committee.
- The Information Services team collaborating with Workplace Content Managers to establish measurable assurance and reporting for the capture and management of records in Workplace, to provide ongoing benefit. **Recommendation 4**

**DfE should build on the current guidance and awareness of staff through a coordinated training and education programme**

This would be supported by:

- Knowledge and Information Management (KIM) stakeholders collaborating with the Internal Communication team on a communication plan to promote the importance of proper Information Management (IM).
- Clearly defining the responsibilities of the Information Services team (and all departmental staff) in terms of IM.
- Ensuring that the IM responsibilities of the Information Services team (and all departmental staff) are promoted and supported by senior managers through agreed governance committees and through targeted and regular messages.
- Including a session on the importance of KIM as part of the mandatory induction for new staff and refresher training for current staff.
- Building on current work with Content Managers (CMs) by encouraging greater collaboration within the CM Community, placing greater emphasis on performance reporting (Workplace), and enlisting key CMs as lead champions within their directorates to monitor and report on performance.
- Developing and promoting a defined IAO community that focuses on providing a portal for joined-up collaboration, communication, and assistance. This should be linked to ongoing risk awareness (of strategic and information risk) and ongoing training and awareness-raising for IAOs.
- Ensuring that the new induction pack includes mandatory Workplace/IM training for end users, and additional training for CMs and IAOs.
- Ensuring that training and awareness includes clear guidance to staff on what information needs to be captured in Workplace (and what can be published to the intranet), and on how, why and when to ‘check in’ and ‘declare’ records.
- Refreshing and promoting guidance through newsletters and desk aids to assist understanding of key tasks when implementing Workplace and Colligo Engage, and when capturing information into Workplace.
- Investigating technical solutions that may reduce the burden of capturing the right information into Workplace. **Recommendation 5**

**DfE should continue to develop its approach to managing information risk.**

This would be supported by:

- Promoting departmental and government risk management policy on an ongoing basis.
- Improving awareness of the assurance that the SIRO provides to DfE and the importance of the role.
- Ensuring that any information risk with potential departmental impact (or higher) is reported to the Permanent Secretary and the DfE Board as standard procedure.
- Reviewing the role of the SIRO and their relationship with the DfE Board; establishing the SIRO as a defined DfE Board member.
- Including updates and reporting on information risk by the SIRO as a standing agenda item for Management Committee meetings.
- Including the examination of the maintenance of critical and high-value systems as part of the annual assurance activities carried out by the Internal Audit team.
- Improving awareness of the Information Risk policy and the importance of tracking, reporting and escalating strategic and information risks to relevant governance committees. This includes the tracking of information risks in relevant lines of business risk registers.
- Coordinating the reporting and oversight of information risk through key stakeholder teams (DSU, Information Services, Knowledge Management Groups) and key users (KIM Champion, Content Managers, IAOs). **Recommendation 6**

DfE should improve its awareness and oversight of information holdings and ensure that all holdings are identified as to current use and future disposal.

This would be supported by:

- Promoting the Departmental Records Officer (DRO) role and responsibilities at a senior level to ensure understanding of their remit at DfE Board level.
- The DRO providing regular reports to the Management Committee on how DfE is meeting statutory requirements and is improving the management of its data and records.
- Reviewing retention and disposal schedules with key stakeholders to ensure that these schedules meet both business needs and statutory requirements.
- Rationalising the digital estate to ensure good information management. As part of this, obtaining guidance and liaising with key stakeholders (including Government Digital Service and The National Archives).
- The DRO liaising with DfE’s third-party storage contractor and developing a review plan to apply required context and retention to any holding that does not meet required standards.
- The DRO collaborating with Estates Management (and other key stakeholders) to identify paper holdings held in current work sites.
- Building on current work to streamline the transfer process by producing a plan for managing the selection and transfer of paper and digital records to The National Archives. 1 The value of information

1.1 Communicating and realising value

Goal: The organisation establishes information’s value in principle and supports its realisation in practice.

Establishing the importance of information

The Department for Education (DfE) has outlined the importance of information in its draft Records Management Policy and its Information Management (IM) Strategy. The Records Management Policy notes that proper records management ensures a good basis for accountability, ensures compliance with relevant legislation, and assists in defining how long records should be retained before they are either destroyed or transferred to The National Archives. The draft IM strategy also provides a clear outline of why information is important.

The Senior Information Risk Owner (SIRO), while relatively new to the position within DfE, is actively engaging with the Information Services team through the tracking and identification of information assets. The SIRO is also driving the importance of information security and the identification and valuation of critical information assets to the Management Committee (which is chaired by the Permanent Secretary). An example of this is the paper to the Management Committee recommending the proper valuation of information assets. The implementation of the SIRO’s recommendations has led to a greater understanding of critical and high-importance information assets and where resources and maintenance need to be prioritised.

Several interviewees noted that the Permanent Secretary was aware of the importance of information management and had stressed that DfE ‘needed to do better at their filing’ – which was interpreted by one interviewee as ‘having confidence in knowing that we have the information, knowing where it is, and can easily find it later for future business needs and statutory requirements’. At a recent Public Accounts Committee (PAC), the Permanent Secretary remarked that: ‘We need to be able to answer the questions about outputs and outcomes, and we need to do further work on making sure we are properly measuring both… it has raised issues about our record-keeping and our ability to bring up the right information at the right time.’

We observed during the IMA that DfE had several roles that focused on Knowledge and Information Management. These included the DfE Knowledge Management (KM) Champion: the Chief Executive Officer for the Standards and Testing Agency (STA). The KM Champion is planning to drive the importance of IM through workshops and promotional material, utilising ‘engaged’ staff (for example, Content Managers). The focus at the time of the IMA was driving best practice at Director Level, but the KM Champion wants to cover operational staff as well. The scope of the role covers both DfE and its non-departmental public bodies, although it is acknowledged that the KM Champion has no additional resources or governance for this role outside of current staff within the STA.

Most operational staff seem to be aware that their information is important, but are still unsure about how it should be managed. There were several messages on the intranet stressing how important senior management regarded knowledge and information management (KIM). These messages mainly focused on the Independent Inquiry into Child Sexual Abuse (IICSA) and the need to identify and safeguard information that might be needed by the Inquiry. At the time of the IMA, the Information Strategy was being reconsidered and re-evaluated by the Management Committee to ensure that it met requirements and provided sufficient direction. DfE is encouraged to continue to promote the value of information through clear, high-level messages, and should ensure that relevant staff are kept informed of the development of key strategies, policies and messages. The requirements for providing IICSA with relevant evidence could also be used as a way of promoting the value of information, and its proper management. See Recommendation 3.

______________________________________________________________________

1 http://data.parliament.uk/writtenevidence/committeeevidence.svc/evidencedocument/public-accounts-committee/kids-company/oral/24013.html Setting goals for information and its management

DfE has undergone significant organisational and IT changes in the last three years (including the rationalisation of operational sites) and will undergo further changes up to the end of 2017. The draft IM Strategy acknowledges that information management within the department is maturing and that work is still required. The strategy outlines where DfE wants to be in the future and provides a broad outline of how this will be achieved. This includes an outline of the key services that will be provided by Information Services (training, guidance, network support for Information Asset Owners (IAOs) and Knowledge Management experts, information storage, management of Workplace). The strategy also notes that delivery plans are to be developed to implement required actions.

The strategy could be improved by highlighting that good information management improves performance by preserving and making accessible key documents and records to help inform

- current and future policy development and decision-making
- better use of high-quality information assets
- potential efficiency savings through improved use of physical, electronic and human resources
- noting the importance of coordinating the management of information with the management of technology and information security.

DfE’s Information Technology Strategy (signed off in March 2015 by the Head of Strategy and Architecture) notes that the

‘Existing IT estate does not lend itself to (its) capabilities and the strategy we are outlining… will not only deliver the IT that the department needs to deliver its overarching vision but also enable the business to take advantage of (its) capabilities.’ ‘DfE already runs an in-house model utilising a multi-source approach for its commodity service provision through government frameworks. While the IT organisation requires further change to enable it to effectively deliver the strategic vision, a significant amount of work has already been undertaken to mature the organisation to the point where it is able to deliver against this strategy.’

DfE has also recently published a Digital Strategy that outlines its vision for change and the plan for transforming DfE into a digital-by-default organisation over the next five years. DfE intends this strategy to be linked to its IT Strategy and the Cabinet Office’s Strategy for Digital. The IT Group will lead on the implementation of the strategies and will update and review them on an annual basis so that DfE can show where and how IT has progressed, and what is still left to do.

During the course of the IMA it became clear that there is no formalised or joined up approach to IT and IM. It was noted by one interviewee that, in respect to the move to SharePoint Online, none of their team (who would be responsible for providing support for end users and Content Managers) was involved in the decision to move to the new platform. One interviewee also observed there has been (for a while) a historical disconnect between how data is managed and how records and information are managed. As part of the annual review of the IT and Digital Strategies, it is recommended that the IT Group liaises with Information Services to ensure IM is considered when systems and platforms are implemented and upgraded. The IT Group should also consider the goals and priorities of the IM Strategy when designing new systems, migrating data, and upgrading current systems. See Recommendations 1 and 3.

Enabling public access to information and supporting transparency and re-use

Requests for information from members of the public are managed by the Privacy and Information Rights Advisory Service (PIRAS), which is part of the Legal Directorate. The PIRAS team and the Data Protection team are linked up under an over-arching internal umbrella covering information rights. From interviews, it appears that these teams have a good working relationship with key stakeholders (the Office of the Permanent Secretary, Information Commissioners Office, Departmental Security Unit, Cabinet Office) and that the teams make sure their stakeholders are made aware of potential or actual security breaches, or any instances of particularly sensitive information requests. DfE’s Management Committee is provided with monthly and quarterly data on Freedom of Information (FOI) performance. This includes the number of queries and how areas are complying (timings, grants in full) so senior managers can see trends on how DfE is performing compared to previous years.

DfE’s response rate for non-routine information requests (covering FOI, Data Protection (DP) and the Environmental Information Regulations) answered ‘on time’ is consistently above 85%. During 2014, the response rate was 90%; there has been a dip for the first two quarters of 2015 (86% and 83%). Non-standard information requests are managed through a key operating system (previously Echo, which was replaced by IRIS). All non-standard information requests should be logged onto the operating system, and DfE has published internal guidance on this. As IRIS was still being embedded, the FOI team was maintaining a separate tracking system alongside IRIS to ensure that accurate statistics were provided to the Management Committee.

Responsibility for responding to FOI and DP requests is devolved to the business areas. The Deputy Director approves release if he or she is satisfied that the information can be released in full. The PIRAS team sees all requests when business areas are not releasing information in full or where exemptions are applied (for reasons of sensitivity or for cost threshold, not held, etc.). The PIRAS team has also developed and circulated ‘aide memoirs’ to all the Deputy Directors setting out their responsibilities under FOI.

We noted that not all users have been using IRIS according to guidance. For example, some users are not closing request cases when the response had been finalised. This has led to distrust in the statistics that IRIS currently provides, as the data does not tally with that provided by business areas. The PIRAS team currently utilises an access database (alongside IRIS) and manually checks every case. To assist the PIRAS team in reporting and tracking FOI requests, end users may benefit from additional training and reinforcement of the need to properly track information requests. See Recommendation 4.

Although DfE has a low overall score in publishing data(^2), the amount of anonymised data published regarding schools and pupils is considered by the assessment team as quite good (312 statistical publications) when considering the sensitivity of the data that it holds. Up to 23 November 2015, DfE had also published 2,733 documents to GOV.UK. This included 170 FOI releases, 237 transparency datasets and 658 guidance documents. The guidance documents mainly contain specific advice for schools and local authorities on the completion of School Census returns, and advice to help schools and local authorities understand how to comply with the law and policies.

As well as this, the IT Group has recently adapted its processes for schools to complete census and exchange information (based on the technological capability of each school) by allowing either online entry, Excel / csv templates, or access through specialised management information systems. DfE has also published guidance, advice and templates for researchers and third parties to obtain special permission to re-use data from key datasets (such as the National Pupil Database), subject to conditions (including data protection, information security, and business need). This shows that DfE is aware of its key client base and that it needs to not only provide targeted and relevant information to its clients, but also to assist its clients in providing relevant data in a format that can be utilised by staff and researchers. This is good practice.

One interviewee commented that DfE has received encouragement from a previous Minister for ‘opening up their data’. The interviewee noted that requests for access to data have doubled (usually from university researchers), and that their team is one of the first in HM Government to use an open source model when publishing data. DfE is aware of the sensitive nature of the information it holds, but is prepared to share and re-use the information with trusted stakeholders to improve the management and planning and schools across the UK. This is good practice.

(^2) Openness score – 0.6 out of 5 – re openly licensed, openly accessible, structured, open format, URIs for entities. data.gov.uk/data/report/openness/department-for-education 1.2 Managing information as a valued asset

Goal: The organisation protects, manages and exploits its information assets to achieve maximum value.

Defining and cataloguing information assets

DfE has an Information Asset Registration and Ownership (IAR&O) Policy (first published in 2009 and updated in February 2015) that outlines what an information asset is and the key requirement of having and maintaining Information Asset Registers (IARs). The policy also outlines clear governance and the reporting structure for information assets from IAOs to the Senior Information Risk Owner (SIRO), and upwards to the Permanent Secretary.

As well as the IAR&O Policy, DfE also places emphasis on how it stores and accesses its information assets through the Business Continuity Management policy. This policy states that areas should ensure that

‘All staff have an understanding of where key documents are stored, that they are kept up-to-date and can be securely accessed remotely if necessary; have an identified system owner for key databases and systems, understanding the disaster recovery plan for those systems and having realistic expectations about recovery in discussions with the IT provider; and [consider] how you would complete…critical tasks if your office or IT systems were disrupted.’

DfE has a central, extensive IAR that clearly notes key fields as recommended in guidance published by The National Archives (owner, team, description, source, business purpose, retention). The central IAR is maintained by Information Services and consolidates IARs held at team level. The IAOs interviewed were generally aware of the importance and rationale behind maintaining an up-to-date IAR – being able to ensure that information (whose loss, theft or corruption would damage the business) is effectively tracked and monitored. The IAR, and DfE’s awareness that it needs to treated as a living document (to be monitored and reported against, and reviewed to ensure it meets requirements), is an example of good practice.

The Finance and Commercial Directorate recently coordinated, through the SIRO and IAOs, a valuation of DfE’s information assets. The valuation exercise and recent internal audits recommended a range of assurance activities to ensure that datasets (particularly critical ones) were properly maintained. The exercise improved senior-level awareness of what critical assets DfE held, and that there are defined operational, reputational and strategic risks to the organisation if data is lost, unavailable, or leaked. It is recommended that Internal Audit (and other relevant areas) utilise the findings of the valuation as part of annual assurance activities. See Recommendation 5.

Despite the documented definition of an information asset, many staff are unsure of what needs to be defined. The result of this uncertainty is that many records and datasets have been included on the IAR that perhaps do not need to be. There are also certain key fields in the IAR that do not appear to be mandatory, such as the date coverage field, which is often left uncompleted. This represents a gap in the description of the asset and may hinder DfE’s ability to allocate appropriate retention periods and identify what information may be due for review and transfer to The National Archives. The Information Services team is currently reviewing what IAOs should identify as information assets to make them more consistent and relevant.

The SIRO is working with the Departmental Security Officer (DSO) and the Information Services team (including the Departmental Records Officer [DRO]) on rationalising the current IAR. The DSO is also reviewing the governance and reporting models, planning to ensure that the reporting of information assets by the IAOs is monitored on a monthly basis, and that accreditation and assurance of systems is at an appropriate reporting level. These actions should be supported by senior management. See Recommendation 2.

As well as reviewing its current definition of an information asset, the Information Services team should review what key fields need to be mandatory in the IAR to ensure that it meets the statutory and reporting requirements. See Recommendation 2.

Ownership of information assets

The IAR&O policy states that all IAOs need to be at Deputy Director level (G7) or above. This is a slightly lower grade than in some other state departments (where the role is usually at Director level) to be responsible for the ownership of data and records and their associated information risks. There are some IAOs who are currently supported in their role by an Information Asset Co-ordinator (IAC). There generally appears to be a good level of understanding as to the responsibilities of both roles. The IAR&O policy mentions the role of the IAC; however, it does not appear to be a role that is noted or acknowledged, for example in annual performance statements. The policy does state that ‘practice may vary according to local business requirements.’ While IAOs may delegate tasks to supporting staff, it needs to be reinforced that the IAO has overall ownership of and responsibility for information assets. DfE should also examine adopting a proportionate approach to ownership of information assets, particularly for those that have been identified as having critical or high-level importance to DfE. See Recommendation 2.

For the governance and assurance of information assets, the IAR&O policy states that the:

‘DfE Senior Information Risk Owner (SIRO)… is required to provide an annual report to the Permanent Secretary in which it must be clear that:

• all Information Assets are listed in Information Asset Registers, and are actively controlled; • every member of the Department has undergone annual Information Risk Awareness Training during the last calendar year and recorded a successful pass; and • all information losses and breaches have been managed effectively.’

The consolidated IAR is hosted on the intranet and is open to all staff. As well as maintaining the central IAR, the Information Services team is also responsible for reviewing the Annual Statements on behalf of the SIRO. These statements must be provided to the SIRO, and are intended to provide assurance to him. The statements are used as key evidence in completing the Annual Governance Statement, which is published as part of the Annual Report (the 2013-14 report has been published).

There has been general discussion between the Information Services team and the SIRO about the fact that IAOs may not be reporting on all information assets, and commenting that not all IAOs are completing required reporting documentation. It was noted that the SIRO and the Information Services Team need to have greater oversight of the IAOs (for example, double checks, challenging understanding, and improving awareness of IAOs as to documentation requirements) and of information assets. The SIRO acknowledged that DfE is currently reviewing the assurance process to ensure that it is evidence-based and that the Permanent Secretary needs to be assured that IAOs are recording all appropriate information assets.

The Information Services team is the focal point for the provision of advice, guidance and training to IAOs. The team has developed a training package (Briefing Pack) for IAOs, outlining their role and responsibilities. This covers maintaining and updating IARs; assigning protective marking; judging the importance (value) of information; identifying what is personal data; and identifying what should / should not be considered an information asset. The pack also notes that each IAO should keep a log of requests for access, but that normal requests for access (as part of general business) do not need to be recorded.

Most IAOs are appreciative of the Briefing Pack (and other guidance) and feel that it assists them in meeting the requirements of the role. Some IAOs noted that, when they were appointed to the role, no initial training was provided. The general impression from many IAOs is that training is not mandatory. The responsibilities and requirements for being an IAO are also not always included or acknowledged in the performance statements or role description for individual staff members.

There is currently no formal network or community of IAOs within DfE. Promoting a defined community would assist in the sharing of good practice and experience and provide a network for collaboration, communication and assistance. It is recommended that the Information Services team should collaborate with the SIRO and the KIM Champion to drive necessary training and awareness – particularly for those new to the IAO role – and ensure that responsibilities are included in performance objectives. See Recommendation 4. 2 Information and supporting technology

2.1 The technology environment

Goal: The technology environment supports the management, protection and exploitation of information.

Corporate storage of information

DfE staff are able to save and access information through a number of platforms. This includes a SharePoint ERMS (known as Workplace), which is the designated corporate repository for official documents and records. Although this is outlined in the RM Policy, many staff commented that they are saving some or all of their emails in email inboxes or shared drives.

Several interviewees thought that Workplace is a good system for saving information. The available guidance was also noted, which is easy to locate on the intranet using search tools, or by speaking to their Content Manager or Workplace Account Manager. The Workplace system has the potential to allow functionality for managing the lifecycle of the record. However, there are a number of limitations that are affecting record creation. Certain tasks (such as declaration of records) are not being performed by users, leading to improper allocation of retention periods and improper disposal. The Information Services team has noted this and the risk is partly mitigated by the fact that no disposal is currently being performed in Workplace. While the system has been set up with the intention of enabling good record-keeping, it is not being utilised in a way that can provide any level of assurance that the DfE is managing its records according to agreed standards, such as the FOI Section 46 Code of Practice for Records Management.

Due to the current set-up of Workplace team sites, it can be difficult for teams to collaborate within DfE, which is a core potential benefit of using SharePoint. The current set-up is problematic for those teams that need to circulate documents to other teams for comment. One interviewee noted that it is more common to send documents via email than to send a link to the relevant Workplace document. This means that many of the changes are tracked within the Word document rather than in Workplace, resulting in multiple saved versions of documents, making it hard to determine who performed the changes and when. It is, therefore, difficult for many teams to determine the final agreed version that needs to be saved as the official record. Staff also commented that sensitivity (or perceived sensitivity) often proves a barrier to sharing the information internally. This affects areas where collaboration and auditable version control is needed.

It was observed by a number of interviewees (and during a demonstration of Workplace to the IMA team) that certain required record-keeping tasks (and the use of the system and email plug-in) act as a barrier and discourage the saving of information. An example is the tool used to assist users in saving emails from Microsoft Outlook to Workplace, known as Colligo Engage. Many users commented that the tool makes saving emails much easier, but that set-up and ongoing use requires the user to manually change many of the system protocols. Although these tasks are covered in appropriate induction training and (once performed) are said to become second nature by those who use them, the Information Services team should consider the benefit of developing desk aids, especially for end users, whose induction training is not currently mandatory. See Recommendation 4.

**Emails**

DfE is currently maintaining a large volume of information in email inboxes or archived Personal Storage Table (PST) files. A number of interviewees commented that work-related emails have been archived into PST files. At the time of the IMA, a third party provider is performing an e-Discovery exercise on all digital information. The e-Discovery exercise will provide data on the total volume of emails held. The interviews indicate that there may be over 100TB of emails and PST files held by DfE – a significant risk and one which severely limits the department’s ability to respond to information requests from senior staff, ministers, public inquiries, and the general public. Although there are published guidelines on what could be saved into PST files (such as tasks and calendar entries) and on what should not be archived into PST files (such as emails that document decisions and key policies), most interviewees were not aware of the approach for using PSTs and the associated rules. We recommend that DfE impose greater restrictions on the use of shared drives and PST files in order to encourage staff to save more of their information to Workplace. See Recommendation 1.

The IT Group is planning to extract and migrate appropriate data from the PST files. At the time of the IMA, the IT Group did not appear to have formally involved other key stakeholders in forward thinking or planning. The IT Group needs to collaborate with the Information Services team, with a focus on identifying and understanding both the IT and IM objectives and the requirements for the migration of emails and PST files. See Recommendation 1.

Shared and Personal Drives

For shared areas, the guidance states that

‘Digital file types that are not compatible with Workplace may be stored in a team shared area [drive], but this must be with the agreement of the DfE Records Management team. Requests for shared areas must be made through the DfE Service desk and will be assessed by the Records Management team.’

It was noted in several interviews that teams are still utilising shared drives for certain documentation and databases. It appears that there is a significant amount of digital information held on shared drives – much more than that held on Workplace. There are certain formats, such as Excel spreadsheets, containing formulas that cannot operate within Workplace. The size of certain documents also hinders their ability to be saved and supported on Workplace.

Several interviewees noted that documentation is being saved to shared drives (even though many said the information should be on SharePoint) as it is easier to

______________________________________________________________________

3 This was confirmed after the assessment by the e-Discovery exercise conducted by the third party – as of December 2015, there were 21 terabytes of information on shared drives, compared to 3.5 terabytes on Workplace. There are also 20 terabytes of information on Personal (F:) drives. save documents to shared drives. In general, most staff that had joined DfE in the last few years use SharePoint rather than the shared drives for the majority of their documents. The use of shared drives may be more of a cultural issue than a technical issue, which Information Services should explore with IT Group. See Recommendation 1.

The Chief Technology Officer (CTO) commented that, after the migration of data and records (as part of the Data Modernisation programme), DfE hopes to lock down the use of shared drives. The new version of Workplace (based on SharePoint Online) will then be considered as the default area for saving official records, and the only place that staff can create and save information. No new shared drives are to be enabled or approved (including personal drives). While this is understood to be an aspiration, having a single trusted repository for official information would assist in decision-making and responding to requests for information: this should be encouraged and supported by senior management. See Recommendation 1.

The Records Management Policy states that: ‘Personal areas (F: drives) used by staff are also not recognised as part of the official departmental records keeping system. Any business-related documents should be saved into Workplace and if a document needs to be retained it should be declared as a record.’ There does not appear to be any defined size limit for personal drives in the submitted documentation or as indicated by interviewees.

Many staff commented that they do use F drives to save documents for a short time. There is a general awareness of the need to save important information into Workplace. It was acknowledged that the emerging findings from the e-Discovery exercise appear to indicate that there is more information on the F drives than was originally thought. It is recommended that DfE reminds staff of the proper use of personal drives to improve the capture of important information into Workplace. See Recommendations 1 and 4. Finding, accessing and protecting information

DfE has implemented certain tools and platforms that allow staff to find and access information related to their roles and tasks, but is aware that it needs to progress these and improve access. As with all information tools, use by staff (saving information in a way that is discoverable later) often determines how effective these tools are in practice.

There seems to be a genuine desire (both from documented evidence and from interviews with staff) to improve how staff are able to access data. The IT Strategy states:

‘IT Group’s vision is to facilitate the successful delivery of the DfE data strategy through a revolutionary approach to data management, coupled with the provision of innovative technology to enable staff to access and manipulate data anywhere, at any time, on devices tailored to their need, while simultaneously driving down the cost and complexity of the Department’s IT estate’.

The goal is that

‘Staff will no longer be constrained by technology in their choice of working location or pattern, with the ability to obtain secure, fully functional, performant access to all of the services and information they require from any device, in any location, at any time.’

There are also a number of areas on the intranet that are used to share and provide information and knowledge to other staff. One area, known as ‘The Knowledge’, allows the publication of information on key subjects, briefing notes and facts. Each entry contains a link to the author and their team area, so staff can contact the person or team who owns the information. Another area, known as Better Policy, has been developed as a special page devoted to improving policy decision-making.

This is good practice. DfE’s staff directory is based on SharePoint MySites. The directory is designed to provide up-to-date information on each staff member’s role and responsibilities, skills, area of organisation, and team name. The entries also include the ability to include past projects and work conducted within DfE and the wider civil service. There had been a recent drive (from the Permanent Secretary down) to ensure that staff details are up to date. While there has been resistance from some areas, the response rate to this drive and the overall accuracy of directory entries have been good; the directory assists staff in knowing the right person to talk to, or to ask for assistance on a particular subject. Having accurate information on roles, interests and responsibilities has also assisted the Internal Communications team in improving awareness and impact of campaigns and key messages. The Permanent Secretary had also contacted all Senior Executive Service level staff (who hadn’t updated their MySite profile) to highlight the importance of having and maintaining accurate information on staff. This is good practice.

During the site demonstration of DfE’s intranet, it was noted that there has been a lot of promotion of certain pages (such as ‘The Knowledge’ and ‘Better Policy’) in the past, but that this promotion has tapered off. The value and usefulness of knowledge-sharing intranet pages and tools such as MySite is dependent on people entering data, maintaining it and sharing it. Good decision-making often relies on having access to reliable, up-to-date information.

The technical set-up of Workplace only allows for the sharing of documents and information to Workplace members within their own team site. Access permissions do not allow staff from other areas to access information from other sites. The allocation of temporary access permissions (to allow interrogation of information or comment to documents) was seen by many interviewees to be very complex and, from the IMA, does not appear to be actively encouraged by senior staff.

A recent paper for the Management Committee noted that there was ‘limited scope for sharing of files beyond existing teams due to restricted access rights. This significantly contributes to sharing of large files, meeting papers etc, by email and creates duplication in documents being held in lots of Workplace. We are pleased to note that this issue has been raised at Management Committee level.’ The paper noted that the Information Services team would conduct research on the DfE’s ‘appetite for relaxing the security constraints, reinforcing the policy on storage of sensitive materials, and making shared access to folders more accepted.’

The focus still appears to be on working in an environment where access to information is not so much securely controlled, but rather blocked off from other teams entirely. While the control of information is important, controls which are too stringent can lead to a less collaborative and sharing culture on issues that require input from key staff and teams – particularly key decision-making and policy development. It is recommended that the Information Services team collaborate with the Departmental Security Unit (DSU), the Senior Information Risk Owner (SIRO) and Policy leads on providing clear guidance as to what information should be captured in Workplace and what specific formats or documentation need to be supported or saved outside of Workplace. Coupled with this, DfE should support Information Services in re-examining the establishment of a more open environment for Workplace to encourage information sharing and enhance decision-making processes, while highlighting that certain teams need more secure control of their information. This review should be linked to the e-Discovery work and give due consideration to the impact of shared drives, PST and personal drive usage. See Recommendation 1.

It is recommended that Content Managers and Policy leads identify which areas they need to collaborate with on an ongoing basis, and liaise with the Information Services team on requirements for establishing shared/controlled Workplace sites. See Recommendation 1. 2.2 The continuity of digital information

Goal: The organisation is taking proactive steps to ensure the continuity of its information, over time and through change.

Oversight of information

DfE has a fair understanding of the systems that support its digital information. DfE has a limited understanding of the context of this digital information (data and records) and in what format it is held.

DfE’s IT Group has been recently tasked, as part of the Data Modernisation Programme, with improving understanding of DfE’s digital holdings (particularly the shared drives). This includes the e-Discovery exercise, which a third-party provider was performing at the time of the IMA. Currently, the CTO provides regular reporting (quarterly) to the Management Committee on the status of the Data Modernisation programme, and additional assurance is provided through external audit and monitoring/reporting through a Non-Executive Board member.

It is understood that the e-Discovery exercise will only provide details on the size and volume of the digital estate, and that the data and records will be migrated (including shared drives) into one single area (without deletion). As part of the migration, DfE plans to test all critical systems and ensure that the systems are operational (and backed up) prior to final release (risk mitigation). This is only part of the task and DfE needs to do more to identify the context and content of the information. Without proper knowledge of the context and content of its information, DfE cannot determine its value and whether it should be prioritised for ongoing preservation, and eventual disposal. It is recommended that the IT Group and Information Services collaborate to develop formal plans to improve their contextual understanding of their digital holdings. See Recommendation 1. Digital continuity planning/IT change

As well as maintaining current systems and services, the IT Group is currently developing a scoring model for new IT projects. The scoring is based on a number of factors, including whether the project is business-critical, has high-level support, and can be cost-justified. An independent body (the Portfolio Management Board) will oversee the review of business cases and supporting documentation. The DSU is involved in accreditation and assurance of new systems, but the final decision about take-up comes down to the Senior Responsible Owner (SRO). If needed, the SRO is encouraged to escalate the decision to the SIRO if there are any information security issues concerning the adoption of new systems.

The IT Group is hoping this process, once adopted, will assist in identifying duplication. Previous processes for review and approval of IT projects have resulted in multiple systems that perform the same role. For instance, there are currently 11 Customer Relationship Management (CRM) systems utilised by departmental staff, for instance. It is planned that, as part of the Data Modernisation Programme, the number of current applications will be consolidated from 135 down to 20. The CTO hopes that this new model will put a stop to unnecessary duplication of systems and resources, and eliminate single projects that do not provide long-term benefit (a defined need, not just a like-to-do). The need to invest in standardising applications and systems has been noted by the Lead Non-Executive Board member as a key priority for DfE. This approach would assist in improving how DfE manages its data. It is recommended that, as part of developing and implementing the new model, the IT Group ensures that key IM stakeholders are included to ensure that IM requirements are considered for future rationalisation of systems and platforms. See Recommendation 1.

There appears to be good awareness of the need to maintain security, including firewalls both for online systems and for those that are moving to the Cloud. As well as the challenges associated with maintaining current systems and services, the biggest challenge (according to one interviewee) will be ensuring that permanent staff within the IT Group have the required technical skills to develop and maintain systems, and ensuring that DfE understands what future skills are needed. As stated, the main focus of the IT Group has been maintaining current systems. Key operating systems have often been developed without the involvement of key IM stakeholders. The CTO commented that DfE wants to prioritise the rationalisation of platforms and applications, and adopt new technology to improve processes and get better use out of its storage. It was observed that the current systems employed by DfE are reliable, but out-of-date. There has also been no focus or discussion on the continuity of current and legacy data and records, and DfE is only just starting to plan for the future management of data and supporting technology. DfE’s key stakeholders in IT and IM are aware that there is bound to be a lot of duplicate information that will be migrated across to the new drive. The Change Director has primary responsibility for leading on this work, which will be conducted after the DfE has access to the e-Discovery data.

DfE has done some work in identifying critical systems/data and its value. DfE has yet to establish an ongoing strategy or plan to ensure that staff can use or re-use digital information for as long as the information is needed. This includes identifying any records or datasets contained within formats that are unsupported or inaccessible. As part of the annual review of the IT and Digital Strategies, it is recommended that IT Group liaise with Information Services to ensure that future plans for the continuity of digital information are developed and implemented. See Recommendation 1. 3 Information risk, governance and oversight

3.1 Recognising information risks

Goal: The organisation defines and manages information risks to minimise threats and maximise opportunities

Documenting and defining information risks

DfE’s Information Risk Policy (updated in February 2015) has been developed in line with the requirements of HMG Security Policy Framework. It meets key requirements in areas such as ownership and defining a risk management structure. The policy ‘defines how DfE manages information risk and how its effectiveness will be assessed’. DfE’s Management Committee (MC), which is chaired by the Permanent Secretary, is responsible for the policy, and the Senior Information Risk Owner (SIRO) oversees its implementation on behalf of the MC. The policy notes that the Information Services team acts as ‘custodian of the Information Risk Policy and supports the SIRO in its implementation’ and that ‘Information risks are not a subset of security risks, but rather a much broader range of possible risks around the effective management, sharing, business use and full benefits realisation of information assets’. This supports an inclusive interpretation of information risk that is not restricted to information security considerations. This is good practice. The policy also clearly establishes how the information risk management process complements and sits alongside the provision of assurance through the information asset governance process.

There appears to be a good level of awareness of the importance of effective risk management (including information risk) amongst senior managers. As an example,

______________________________________________________________________

4 An information asset is a body of information, defined and managed as a single unit so it can be understood, shared, protected and exploited effectively. Information assets have recognisable and manageable value, risk, content and lifecycle (The National Archives: What is an Information Asset - nationalarchives.gov.uk/documents/information-management/information-assets-factsheet.pdf). An information asset is information that is owned and/or used by the department that has value in meeting the department’s business need (at the highest level). For example, financial information, intellectual property or employee details or information entrusted to the department by a third party. the Lead Non-Executive Board member noted that ‘risk is an important part of the information architecture’. This level of awareness was not as clear among the operational staff that were interviewed. One interviewee noted that DfE has only really started to understand and articulate the risks, and was concerned that information risk specifically relating to IM and RM is not talked about enough.

The information risk policy states that information risks should be recorded in business risk registers, with an escalation route through unit risk registers. This includes the Information Services risk register for records management related risks. Among interviewees, we saw a good practice example of a line in a business risk register that included risks relating to ‘decisions, issues and evidence… not [being] sufficiently recorded leading to potential reputational damage if decision reviewed by external body or committee’. To ensure that contingencies are implemented, the area would:

‘Put in place strong Project and Programme Management measures, including risk management and assumptions logs. We will agree clear decision-making processes with stakeholder groups to ensure all decisions and supporting evidence are captured, mapping decisions ahead of time, [and] adhere to good records management processes.’

This is an effective example of a business area identifying the impact of failing to comply with policy as a risk cause and promoting good practice in information and records management as a means of managing the risk. However, we understand that no Information Services risk register has yet been created. DfE needs to ensure that it is monitoring information and records management related risk above a local level, to arrive at an overall view of the threats raised by cultural, governance and technology related causes. See Recommendation 5.

**Implementing an information risk management approach**

DfE’s Information Risk policy states that information risks should be noted in relevant lines of business risk registers and escalated as appropriate. This should be through the relevant manager and up to the SIRO as needed, who would then forward to the relevant governance committee:

- Audit and Risk Committee: meets at least five times per year and focuses on the Department's accounts, financial risks, accountability and propriety
- Management Committee: meets monthly and focusses on the running of the Department, implementing the review, finance, HR, building block risks and Department of State business
- Performance Committee: meets monthly and provides detailed challenge and scrutiny of the Department's performance on reform priorities.

The framework also notes that there are other risks (including information security, correspondence and FOI) that need to be monitored and reported against – ‘Information risk management briefing and reporting via the Senior Information Risk Owner (SIRO)/Departmental Security Unit (DSU)’. The main information risk that DfE is monitoring relates to its technology. Internal Audit conducts an annual programme of assurance covering security (including cyber security) and system performance. DfE has recognised that risks should be managed according to impact/likelihood.

The SIRO noted that the governance and reporting structure of information assurance and risk is being reviewed. To promote the importance of information risk, the SIRO noted that DfE is trying to do more at a strategic level, but that obtaining traction across the department will come down to resources and awareness of the importance of information assurance. The Lead Non-Executive Board member noted that information risk and information management are not being championed or escalated to the Board or the Audit and Risk Committee – and commented that there should be a defined reporting relationship from the responsible positions (the SIRO and DRO) to these governance bodies and that the importance and remit of those roles should be understood. See Recommendation 5.

In general, there appears to be collective ownership regarding information risk. A devolved approach to information risk is acceptable; nonetheless, the SIRO should have overall responsibility and ownership for information risk. Although this is articulated in the Information Risk Policy, DfE should promote the importance of the SIRO role. The Management Committee should ensure that senior and operational support is provided to the SIRO so that they can lead on understanding and promoting the importance of information risk, including those relating to IM and RM. See Recommendation 5.

DfE’s policy is

‘To conduct an annual security risk assessment and a Security Policy Framework compliance check in order to complete the Departmental Security Health Check (formerly known as the Security Risk Management Overview or ‘SRMO’), and defined by the Cabinet Office in the “Departmental Security Health Check Guidance Notes (Cabinet Office) (Annually revised)”’. This is to include information risks. A description of the process applied in conducting each year’s assessment will be documented within each report.’

As part of implementing policy covering information security, this will be delegated to individual areas. The DSU is planning to align DfE’s approach to HMG Security Policy Framework, and will determine the level of take-up by areas based on departmental priorities.

DfE has published guidance concerning information risk, incident reporting, and clear guidelines for roles and responsibilities. It was also reported that 96% of staff had completed the online e-Learning course on Information Security (Responsible for Information). Despite this, the impression from senior management and from the interviews is that the tracking and monitoring of risk is not treated with the same level of importance at an operational level.

DfE is planning to improve awareness of the importance of risk registers, but acknowledges that mandating the creation of registers and monitoring their use is a key challenge. Several interviewees commented that there is more recent emphasis from senior management, including the Permanent Secretary, of the need to properly manage information and their associated risks. DfE should continue to promote awareness and ensure that key messages are approved and sent out with the clear authority of the Permanent Secretary. See Recommendation 5. DfE should make this part of ongoing education and awareness about information risk and the requirements and benefits of accurately tracking risk. This needs to be coordinated through key stakeholder teams (DSU, Information Services, Knowledge and Information Management Groups) and key users (KM Champion, Content Managers, Information Asset Owners [IAOs]). It is also recommended that ongoing awareness and training for strategic risk and information risk (including the use of business risk registers) be linked to the recommended training for IAOs. See Recommendation 4.

### 3.2 Establishing control

| Goal: The organisation has effective governance structures in place that foster communication and strategic planning. |

**Governance structures**

The management of information (covering records, data, technology, awareness and risk) is discussed and reported at a high level: the Management Committee, which is chaired by the Permanent Secretary. Responsibility for the management of information, and the championing and promotion of proper information management, is partially devolved to key senior officials (such as the SIRO, the Chief Technology Officer, the Chief Executive Officer of the Standards and Testing Agency, and the Change Programme Director).

There appears to be informal collaboration between all of these officials and general awareness of their priorities and responsibilities. The overall co-ordination of IM is informal and relies very much on personal relationships rather than documented responsibilities and mechanisms for monitoring, promoting and reporting on IM performance and improvement. Reporting on current and emerging issues regarding IM should be conducted upwards to the Management Committee, as in the current arrangement, but issues need to be the responsibility of one official. In order to provide a solid base for driving IM across the department, an overarching senior governance board (covering IT, digital, data and Information Services) should be established. Similar boards within Home Office, HM Treasury, and the Department for Work and Pensions have helped enable a more joined-up approach to how these departments manage their data and records – and the technology that provides the platform for staff to do their job. See Recommendation 3.

Supporting the business

The Information Services team is currently made up of 26 staff members who report to four managers, each of whom has responsibility for one of four individual teams (IM team, RM team, Change Programme team, and the Internal Communications team). There is also a senior official (G7) who is responsible for stakeholder engagement and communication.

There are documented roles and responsibilities for the Information Services team within published guidance and policies. These include providing assistance and advice for internal projects, support for users of Workplace (covering training and awareness, sharing best practice, and organising communications), providing advice and guidance regarding the value and retention of information, and assisting in the development of internal publications and communications through the intranet. The IM Strategy (draft) also provides a high-level outline of how the Information Services team intend to support DfE in the future. The DRO and the Head of IM are currently developing a joined-up Delivery Plan to drive the role and responsibilities of the Information Services team in providing assistance to the rest of DfE.

In the past few years, the main focus of the IM team has been in providing guidance and prioritising resources and support to the Workplace Content Managers (800 at the time of the IMA). The focus of the RM team has been in meeting the requirements of the 20-year rule implementation plan (the transfer of selected records to The National Archives). This focus is broadening to include a better understanding of the scope of DfE’s paper and digital records, and the responsibilities that come from this, which is good practice. A ‘Service Catalogue’ outlining the services that the IM team provides has been developed. However, this focuses on knowledge management (such as knowledge capture for leavers, and facilitation of discussion groups). Several interviewees noted that there is no broad awareness of the services that the IM or RM teams offer. The Information Services team has direct responsibility for the development of guidance, and Content Managers provide a supporting role in providing advice to end users within their team. We noted that some Content Managers have also taken up the responsibility of promoting the importance awareness of IM to end users. The impact on their teams of those that were interviewed varies, depending on their proactiveness and dedication to the role. Content Managers may also not be best placed to lead on the championing of good IM practice. It is recommended that Information Services define its responsibilities for the championing and awareness of IM throughout DfE, and how this will be delegated to senior staff, IAOs and Content Managers. See Recommendation 4.

It was acknowledged in the interviews that IM and RM services are not being run in a coordinated way, and that current work can overlap (particularly in respect to Workplace). The DRO and the Head of IM noted during the IMA that they want to work more collaboratively and do not want to duplicate effort, or say things that are contradictory to what DfE should be doing. This awareness of the need for a collaborative relationship and approach to IM and RM should be encouraged and noted by senior staff. A defined and coordinated approach to information management, with the lead being the Information Services team, should be promoted and supported by senior managers through agreed governance committees. See Recommendation 4.

As part of driving the Delivery Plan, the DRO and the Head of IM should consider defining the specific roles and services that the team provides into one document – and ensure that key staff (including Content Managers, IAOs, and members of Knowledge and Information Management [KIM] groups) are aware of the roles and services through targeted and regular messages. See Recommendation 4. Support networks

The Content Managers are supported by six Workplace Account Managers within the Information Services team. All new Content Managers must be trained in the use of Workplace by a Workplace Account Manager, and the IM team provides additional ‘train-the-trainer’ sessions to assist Content Managers in providing training and guidance to end users. We consider this a measured and proportionate approach given the number of Content Managers within the department and the number of Workplace Account Managers within the Information Services team.

The IM Team currently encourages collaboration and communication through a combination of direct communication, targeted messages, and intranet newsletters. There is also an intranet page entitled ‘Making the most of Workplace’ (updated twice a month), which includes articles aimed at Workplace members on tips and tools aimed at improving teams’ use of their Workplace site.

The IM team keeps track of all Content Managers through a register to ensure that they all receive messages regarding new/updated guidance and upcoming training for Content Managers and end users. There is also a discussion board for Content Managers on the intranet; however the IM team has observed that there has only been intermittent interest in its use.

Due to the numbers of Content Managers within DfE, spread across six sites, the IM team is trying to encourage greater collaboration and to see themselves as a community. There has been some interest from individual Content Managers for promoting and assisting in the ‘CM Community’. For those Content Managers that are able to provide this support, networking and collaboration should be noted and encouraged by their line managers. See Recommendation 4.

Although Content Managers are able to develop reports on Workplace usage – such as how many documents are unmanaged – these reports (and actions that lead to improved performances) do not appear to be utilised by the wider CM Community. One example was noted during the IMA where a Content Manager had published the results of their ‘clean-up’ exercise through the CM Newsletter. This example of using current tools to improve performance and publish good practice should be encouraged.

Most of the Content Managers that were interviewed are aware of who the IAO is within their team; there does not appear to be a corresponding network of IAOs or any obvious link-up between the work of the Content Managers and the responsibilities of the IAOs. The IM team managers noted that they want to be more engaged with the IAOs and encourage productive collaboration and communication between IAOs and the Information Services team. It is recommended that the development of an IAO network (and building connections to the work of Content Managers) be linked to the recommendations for ongoing risk (strategic and information risk) awareness and ongoing training and awareness for IAOs. See Recommendation 4.

3.3 Providing direction

Goal: The organisation gives staff the instruction they need to manage, protect and exploit information effectively.

Knowledge and Information management policy and guidance

DfE has recently reviewed its Records Management Policy and the policy regarding the use of the corporate information management system (Workplace). The policies were signed off and approved by the Deputy Director for the Information Services team. The Management Committee noted and approved the policies, which is good practice. The Records Management Policy provides clear direction as to why records management is important to DfE (linking this to statutory requirements and the Civil Service Code), and highlights that records cover all formats (paper and digital). The purpose and rationale behind capturing information and records is also covered in the RM policy and the Workplace Policy.

The RM policy states that the default format for saving information is digital and that ‘departmental policy is that, wherever possible, records should be stored in electronic Corporate Records Centres and accessed from Workplace’. The Workplace Policy specifically defines a framework for use of Workplace, including the roles and responsibilities of the Information Service team (Workplace Account Managers), Workplace Content Managers, and Workplace end users.

The scope of available guidance is fairly comprehensive, particularly for the use of Workplace. Despite the comprehensiveness of the guidance, several interviewees were unclear as to the overall purpose or rationale of certain operational instructions. For example, several Content Managers and end users are unsure about when to save and declare a record in Workplace, why it is important to do so, and what the difference was between undeclared and declared records. One interviewee thought this meant declaring a record for transfer to The National Archives. The Information Services team should look to further promote the two overarching policies for RM and Workplace, and also make sure that Content Managers and end users clearly understand the rationale and purpose behind key Workplace instructions. As part of this, the team needs to ensure that Content Managers and end users clearly understand what records should be declared and why. See Recommendation 4.

Several staff noted that they are currently reviewing their file structure within Workplace. Most of these staff are aware of the need to collaborate with the Information Services team on this task. It was noted that some set guidelines as to what should and should be not used, such as filing structure and titling, would be of assistance. There are published instructions for staff that define proper file structures and naming conventions. However there is no defined classification scheme or taxonomy to assist Content Managers and their teams in establishing appropriate file structures and the titling of documents and records. It was observed that a defined classification scheme has been developed for the intranet by the Information Services team. The relevant managers within Information Services should look at customising this classification scheme and utilising it as a template for establishing controlled file structures in accordance with current guidelines. See Recommendation 1. What to Keep

DfE is in the process of updating its What to Keep guidance. The guidance links to intranet pages regarding the disposal of information, and also contains guidance as to what should be defined as a record and what should not. The Information Services team has published policies and guidance on where information should be stored, depending on specific criteria.

Information that is created or uploaded into Workplace is given a defined retention period, but only if the content type is defined. If not defined, then the content type is ‘unmanaged’ and given a retention period of two years. The clear message from the interviews was that only a few staff appreciate why the content type needs to be defined. There is a risk that key strategic information will either be deleted or saved in a way that will hinder future discovery. The Information Services team has noted the risk and are not deleting any information saved to Workplace. The importance of clearly defining what needs to be saved into Workplace (and defining content type) should be linked to the recommendation covering the rationale and purpose behind key Workplace instructions. The Information Services team should also investigate possible technical solutions that may reduce the burden of capturing the right information into Workplace. See Recommendations 1 and 4.

Providing training

The IM team is responsible for providing basic and advanced training for Workplace users and Content Managers. Both training sessions finish with an overview of records management. Examples of both training sessions were provided, and appear to provide a good overview of the importance of information management and the use of Workplace. These training sessions are offered on a monthly basis, and are mandatory for new Content Managers – but are not mandatory for new users.

It was noted by several interviewees that KIM is not part of the induction for new starters or when moving between teams. At the moment, there is no corporate training package for new staff or for those moving between teams. There is also no awareness of a defined process to follow for those leaving DfE, although this has been included as part of the Service Catalogue provided by the IM team. The Human Resources team is developing a new induction pack. The Information Services team is feeding into this development, and it should include mandatory Workplace/IM training for end users, and additional training for CMs and IAOs. This would help ensure that the importance of IM (and thus the use of Workplace) is promoted and mandated. See Recommendation 4

Several teams have developed their own knowledge capture procedures for staff that are about to leave the team or the department. The managers of one team maintain a ‘crib sheet’ on the current status of projects and performance, which is updated quarterly – so if someone leaves unexpectedly or is sick, the manager who is temporarily taking over that task has a good awareness of how the project/contract and the development/performance is progressing. Solid Key Performance Indicators, and a RAG system which is reviewed based on risk, would contribute to ensuring accurate measurement of performance to DfE.

At the time of the IMA, the Information Services team were planning a ‘Knowledge and Information Management Learning Month’ for December 2015. This was to cover all departmental sites and include presentations showcasing current and new guidance, and highlighting best practice within and external to DfE (including at The National Archives). One of the sessions was to focus on departmental subject terminology, looking at encouraging standardisation of the use of terms in file structure and titling.

DfE conducts regular ‘Learning Months’ that provide a platform for sharing experiences and learnings, and for improving awareness of the department’s priorities and future planning. One interviewee highlighted that certain ‘Learning Months’ have proved to be quite popular. Podcasts are also prepared to ensure that staff can assess presentations at their desks or through other online means. DfE’s Learning Months are evidence of a department-wide approach to sharing experience and knowledge and should be noted as good practice. It is hoped that DfE is using the KIM Learning Month as a springboard to implement an ongoing information management training and awareness programme across DfE. The KM Champion for DfE plans to liaise with the Information Services team as part of identifying key learnings and priorities coming out of the Learning Month. It is recommended that key KIM stakeholders collaborate with the Internal Communication team in developing a communication plan to promote the importance of proper information management. This could be linked into the recommended training programme for IAOs and Content Managers. See Recommendation 4.

### 3.4 Measuring impact

| Goal: The organisation measures performance in practice and takes informed, risk-based action as a result. |

**Measuring compliance with policy**

DfE does not currently monitor how areas are performing or improving, and is in the early stages of defining and understanding how to assess progress and performance against strategic and IM goals. There has been discussion in the past about developing an information management maturity model, and there is a KIM tool that measures how an area is managing information and knowledge. This tool is not part of ongoing measurement reporting and appears to be unsupported by the current IM team. Much of the responsibility for control or monitoring of the structure and titling of folders and records within Workplace is down to the Content Managers. The Lead Non-executive Board member noted that the DRO’s remit should be acknowledged and involved in evaluating how data and records are stored and managed, and be able to provide a measure of compliance.

Content Managers are able to obtain reports through their Workplace site that provide metrics on use. The reports can cover how many documents are being captured on a monthly basis, how many documents are not declared as records, or how many are ‘unmanaged’ (no defined content type). Not all Content Managers are aware of this functionality. The IM team have published guidance for Content Managers on the importance of monitoring the use of Workplace. It was acknowledged that compliance with the guidance is not enforced or monitored by the IM team. The IM team should look to using the CM Community and IAOs to assist in measuring and benchmarking standards for capturing and managing records in Workplace. See Recommendation 3.

At the time of the IMA, DfE’s Internal Audit team were liaising with Information Services about reviewing how the department manages its information. The audit was likely to happen in 2016. Previous reviews into the overall operation of teams have noted issues with record-keeping, but also noted that other areas are quite meticulous. While the scope of the KIM audit had yet to be determined, it is understood that any audit would include use of systems such as Workplace. The National Archives has provided emerging findings from the IMA process to assist the Internal Audit team in defining the scope of the planned audit and future reviews.

The Management Committee has been recently updated about the issues of knowledge sharing and file structures within Workplace. The current functionality and set-up of Workplace does not allow oversight by the IM team or allow the creation of reports on the capture of information. There is no assurance that Workplace users are performing key actions such as defining content type. Such functionality would greatly assist in monitoring use, and DfE should ensure that key reporting functionality is included in any planned upgrade of current systems. See Recommendations 1 and 3. 4 Records, review and transfer

4.1 Oversight of records and selection

Goal: The organisation understands the value of its records and can consistently identify those with enduring historical value.

Position of the Departmental Records Officer (DRO)

The DRO has five staff (the RM team) who provide assistance and support in meeting the requirements of the Public Records Act and the 20-year rule implementation plan. The role previously focused only on meeting the requirements of paper records. This is changing to also cover digital – particularly digital information held in Record Centres and Workplace – and gaining a better understanding of the scope of DfE’s paper and digital records. Due to recent organisational moves and site rationalisation, several staff have left the team and new staff have had to be recruited and upskilled. To improve knowledge and understanding at DfE, The National Archives delivered a bespoke training day in October 2015 for all RM and IM staff.

The DRO is involved in the e-Discovery exercise being performed by a third party provider. This exercise will give DfE a better understanding of the volume of digital holdings, particularly in the shared drives. The DRO noted that the findings of the exercise will be used by the new Digital Records Reviewer to improve understanding of the content and context of the digital holdings, and define what information does not need to maintained by DfE.

The DRO recognises the importance of noting and reviewing information risks on business risk registers, and is working with the Head of KIM to establish a unified information risk register that encompasses all aspects of information and records management. They are also looking to establish a more structured and formalised governance process for recording / monitoring information risk and for the management and recording of, and reporting on, Information Assets. The DRO also wants to include the Data Director, who is reviewing and developing policy on the collection of data by DfE. Although the DRO appears to be well positioned to influence at an operational level, strategic influence and accountability to the Management Committee depends on line reporting through senior managers. To strengthen the accountability of this role, which has also been suggested by the Lead Non-executive Board member, it is recommended that the role and responsibilities of the DRO be promoted at a senior level to ensure understanding of the remit at DfE Board level. The DRO should also provide direct reports to the Management Committee as to how DfE is complying with statutory requirements and how DfE is improving the management of its data and records. See Recommendation 6.

Oversight, control and use of records

Those areas that still have requirements for creating paper records, such as contracts and procurement, have a good sense of the need to store paper records in a secure way. An example is the area that has been tasked to identify and provide paper records to the Independent Inquiry into Child Sexual Abuse (IICSA). The area exhibits good awareness of the need to properly store and manage sensitive paper files. The records are securely stored and only accessible to authorised staff. The area is currently liaising with IICSA to ensure that records are securely controlled and that certified copies are provided where the production of original records is not required. This will include records that are currently held by The National Archives.

Interviewees recognised that, once no longer required for ongoing business purposes, the paper records need to be forwarded to DfE’s third party storage provider. A member of the RM team engages with the third party provider as a key part of their role. Their main task is to ensure appropriate metadata fields are completed prior to transfer. Most of those interviewed find that it is quite easy to request records back through the RM team.

Although we saw clarity on the need to follow required processes at a local level, there is limited assurance that the Information Services team has a complete understanding of which teams within DfE are still creating paper records. The recent closure of departmental sites included identifying legacy records and non-record file series. The Information Services team was involved during these site closures, and has been liaising with The National Archives on appraising the value of certain file series. Prior to the move, areas were encouraged to dispose of paper – but only if the information was a duplicate or copy of information that was captured elsewhere, such as in Workplace – and transfer everything else to DfE’s third party storage provider.

The fact that all paper records are forwarded to the third party storage provider gives a good indication that DfE can provide accurate figures for its Records Transfer Report (RTR) return. There is a risk (expressed by one interviewee) that during the recent site closures, certain records may have been forwarded to the storage provider without the oversight of the DRO or the RM team. Certain information may therefore have been forwarded without proper identification (metadata) or retention. It is recommended that the DRO obtains a report from the storage supplier of all records transferred in the last three years, determines which transfers may have been transferred without proper oversight, and develops a review plan (if applicable) to apply appropriate context and retention. It is also recommended that the DRO collaborates with Estates Management and other key stakeholders (such as the SIRO) to identify other paper holdings that may currently exist in current departmental sites. See Recommendation 6.

DfE has significant holdings of digital records and data held in shared drives and Legacy Records Centres, dating back to the early 1990s. Some of this information was migrated and can be accessed through Workplace and other data management platforms. Many records are still being maintained on shared drives or PSTs with no oversight by the Information Services team. Due to these issues, and inconsistent use of naming conventions for records and file folders, DfE cannot guarantee that users can access all legacy digital records needed to perform their roles. One interviewee noted that several projects have been impacted due to the inability to access legacy information. Having access would allow teams to compare past and present methodologies and decisions. This inability has not prevented the project teams from doing their work but it has made it more difficult and meant that staff have basically had to start from scratch. The current Data Modernisation programme will provide a better oversight of the size of DfE’s digital holdings. However, there still remains the challenge of proper identification, valuation and rationalisation of the digital information. The indications from the interviews are that this will, for the majority of the information, be a manual exercise and the responsibility of the information owners. It is understood that DfE is currently liaising with the Cabinet Office and Government Digital Service on developing proper protocols for managing and improving identification of digital information for IICSA. As well as improving access and searching functionality to their current digital holdings, DfE should liaise with the Government Digital Service and The National Archives to rationalise its digital estate using automated file profiling tools. This is in line with the recommendations of the 2015 Sir Alex Allan report into the management of digital records. See Recommendation 6.

Appraisal and selection

In 2014, the previous DRO conducted a review of DfE’s Operational Selection Policy (OSP 19 – originally published in 2004). The review, on which the DRO consulted and collaborated with The National Archives, focused on extending the scope of the OSP. At the time of the review, DfE noted that the OSP had proved an effective working tool for reviewers.

The RM team is generally engaged with The National Archives. There are fortnightly teleconferences between the review team and the Information Management Consultant (IMC), for example. In the past, the RM team has been consistently utilising the OSP and relevant appraisal tools to review files and provide assurance to The National Archives IMC. With the recent changes and the employment of new (and less experienced) staff, the ability of the RM team to meet its previous level of assurance is at risk. As part of the recent bespoke training day, the requirements of selection and providing clear justification for disposal were reinforced. It is hoped that this training and follow-up advice will improve the knowledge and understanding of RM staff and assist them in providing greater assurance to The National Archives. 4.2 Implementing disposal decisions

Goal: The organisation understands the process for records disposal and consistently implements decisions in line with defined plans.

Triggers for disposal

Until the moratorium on destruction of information relating to child sex abuse, DfE was disposing of information according to retention and disposal schedules. It was noted that schedules submitted as evidence are based largely on the model retention and disposal schedules developed by The National Archives. This represents a misunderstanding of the purpose behind the model schedules published by The National Archives. The model schedules are guides only and should be utilised as a template for further work and development by the responsible department. The DRO noted that the disposal schedules are currently being reviewed, which The National Archives will support by providing commentary. It is recommended that, as part of this review, the DRO liaises with key stakeholders (such as Content Managers, the Privacy and Information Rights Advisory Service team, Internal Audit, and the Private Office) to ensure that DfE’s retention and disposal schedules meet the statutory and business needs of DfE. See Recommendation 6.

The RM team is aware of the need to appraise and properly retain digital information, which would include identifying and selecting records for transfer to The National Archives. This work is currently awaiting the detailed analysis of DfE’s digital record holdings (part of the Data Modernisation programme). Due to this, the disposal moratorium, and because many documents within Workplace are either undeclared or are ‘unmanaged’ (meaning that the documents have a minimum two-year retention), no digital information is being disposed. The culture of DfE is one that is not inclined to dispose of information (staff who were interviewed preferred saving information), even if this means that it is not being saved or shared in a way that facilitates access, ongoing and future work, or decision-making at the highest level of DfE. It is recommended that, as part of ongoing training and awareness programmes, awareness of the importance of allocating appropriate content types and record declaration is reinforced. This is not only important in meeting statutory requirements and the requirements of the Records Management Code of Practice (issued under the FOI Act, s.46), such as the allocation of proper retention, it also ensures that important documentation can be discoverable for future programmes and in response to requests for information. See Recommendation 4.

Sensitivity review

Due to the recent changes, the review team is very new to sensitivity review, which is impacting on the transfer process. The DRO acknowledged that they need to improve the sensitivity review skills of the RM team. We are pleased to note that DfE is currently developing new internal guidance for staff, which is with The National Archives for comment.

DfE has inherited a legacy of information from other departments relating to Children’s Homes. There is a general understanding of the content and context of the files. However, the DRO is still in the process of determining how to review them for sensitivity. It is recommended that the DRO apply to the Advisory Council (AC) for retention of these files to allow for the implementation of a coordinated plan to review and facilitate eventual transfer of selected files to The National Archives. See Recommendation 6.

Transfer and planning

At the time of the IMA, DfE was generally compliant with the 20-year rule implementation plan. The RM team was reviewing and preparing files from the 1987-88 period, and was planning to have 1989-90 files transferred by the end of 2016. The Records Transfer Report for Spring 2015 noted the legacy material relating to Children’s Homes, and the RM team is aware that additional material will need to be retained with the approval of the AC.

The RM team is aware that the volume of DfE’s paper holdings for the 1990s rise dramatically in comparison to its pre-1990 holdings. To cope with this increase, DfE is streamlining the transfer process and is working with a Continuous Improvement Expert. At the time of the IMA, the results of this analysis were being collated for action by the DRO. The National Archives’ IMC will be involved in the analysis and review of the expert’s findings. To support the DRO in this task, it is recommended that the DRO liaise with The National Archives in developing a forward plan for managing the selection and transfer for growing volume of paper records, and for the eventual transfer of digital records. See Recommendation 6.